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document. A process log of the signing is kept for future refer- 
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WEB-BASED METHOD AND SYSTEM FOR APPLYING A LEGALLY 
ENFORCEABLE SIGNATURE ON AN ELECTRONIC DOCUMENT 

5 FIELD OF THE INVENTION 

The present invention relates to the electronic signing of documents, and more 
particularly concerns a web-based process and system allowing the legally 
enforceable signing of documents in a web environment, which does not require 
the user to install any special signing software on his system. 

BACKGROUND OF THE INVENTION 

In the Web e-commerce world, physical handwritten signatures are often 
considered an unnecessary burden to a process that users expect to be fast, easy, 
and reliable. An increasing number of businesses are engaged in Web-based e- 

1 5 commerce activities and require the legal signing of contractual documents or 
records as part of delivering their Web-based services. These types of applications 
are prevalent in financial services that are affected by the E-Sign law. In this 
environment, users currently go to the service provider's Web site and are required 
to download and print documents, physically sign them, and send the signed 

20 documents back to the service provider either by Fax or mail. This results in added 
delays, increased costs, and additional manual processing on the part of the 
service provider. Web-based service providers or operators of Web sites would 
prefer to have their customers review and legally sign any required contractual 
documents or records directly and in real-time on their Web site, where users 

25 would only need a Web browser to complete the transaction as quickly as 
possible. 

To understand what "signing" means, one needs to consider the Uniform 
Commercial Code (UCC) which defines a signature as a mark or symbol of the 
signer's intention to authenticate a written document. The Electronic signatures in 
30 The Global and National Commerce Act (a.k.a. E-Sign law) defines an electronic 
signature as an electronic sound, symbol, or process, attached to or logically 
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associated with a contract or other record and executed or adopted by a person 
with the intent to sign the record. Therefore, an electronic signature can be 
represented by one's name that is typed into a Microsoft Word document or by 
clicking on an "I Agree" button at the end of a series of Web pages, as long as the 
act of signing is somehow attached to or associated with the contract or record 
and with the person who is signing. 

Either of these methods would be ideal on the Web. However, without security 
to protect the attachment or the association of the signature to the document or 
record that it is authenticating, it will not be considered reliable and the contract 
would not be legally enforceable. This invention provides the equivalent of a 
legally-enforceable "I Agree" button or a typed name and signing process that is 
secured through PKI technology or other means without the complexity of issuing 
digital certificates to each user who needs to sign and then having to manage all 
these digital certificates. 

To date, having a secure electronic signature meant providing each signer 
with a unique, secure identifier that was used to sign through cryptographic 
techniques. Such an approach is difficult to implement and use. The present 
invention separates the "signing" and security into two separate functions and 
leverages the fact that Web sites using this invention will be able to create and 
maintain their own unique identifier for the signer where this unique identifier is 
used by this invention to electronically sign the document. Security is then applied 
in a unique manner that is optimized for this Web environment. 

SUMMARY OF THE INVENTION 

In accordance with a first aspect of the invention, there is provided a web- 
based method for applying a legally enforceable signature of a user on an 
electronic document, the signing of said document occurring in a web 
environment. The method includes the following steps: 

a) having the user access the web environment from a secure electronic system, 
said secure system having verified the identity of the user; 
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b) having the user sign the electronic document in said web environment, said 
signing comprising the substeps of: 

i) presenting the user with a web-based representation of the document; 

ii) presenting the user with legal information related to said signing, and 
5 getting agreement from the user of said legal information; and 

iii) upon agreement from the user of the legal information, applying said 
signature of the user on said document; 

c) generating a process log of the signing of step b) and securely associating said 
process log with the document assigned; and 

1 0 d) making the document as signed available to the user. 

In accordance with another aspect of the invention, there is provided 

another web-based method for applying a legally enforceable signature of a user 

on an electronic document. The signing of said document occurs in a web 

environment, and the method includes the steps of: 
1 5 a) having the user access the web environment from a secure electronic system, 

said secure system having verified an identity of the user; 

b) having the user sign the electronic document in said web environment, said 
signing comprising the substeps of: 

i) presenting the user with legal information related to said signing, and 
20 getting agreement from the user of said legal information; 

ii) presenting the user with a web-based representation of the document; 

iii) getting confirmation from the user that the document is to be signed; and 

iv) applying said signature of the user on said document; 

c) generating a process log of the signing of step b) and securely associating said 
25 process log with the document as signed; and 

d) making the document as signed available to the user. 

According to yet another aspect of the invention, there is provided a system 
for applying a legally enforceable signature of a user on an electronic document in 
a web environment. 

30 The system first includes accessing means for accessing the web 

environment from a secure electronic system. 



I 
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The system according to this aspect of the invention also includes a plurality 
of modules. A document-rendering module is provided for presenting the user with 
a web-based representation of the document. Also provided is a legal disclosure 
module for presenting the user, in the web environment, with legal information 
5 related to electronically signing the document, and for obtaining agreement from 
the user of this legal information. A document approval module for providing the 
signature of the user to the document, upon agreement from the user of the legal 
information, is also provided. The system further includes a process log module for 
generating a process log of the signing of the document and securely associating 
10 this process log with the document as signed. Finally, a document distribution 
module for making the document as signed available to the user is also provided. 
COMMENT: NO MENTION OF THE CUSTOMIZATION OR THE USER BINDING 
MODULES HERE. 

Other features and advantages of the present invention will be better 
1 5 understood upon reading of preferred embodiments thereof, with reference to the 
appended drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a flow chart illustrating the interactions between some of the key 
20 modules that are part of a system according to a preferred embodiment of the 
invention. 

FIGs. 2A to 2D define together the flow chart of a method according to a 
preferred embodiment of the invention. 

FIG. 3 illustrates various modules according to an embodiment of the 
25 invention more elaborate than the embodiment of FIG. 1 . FIG. 4 illustrates a 
preferred embodiment of the invention put into practice. 

DESCRIPTION OF PREFERRED EMBODIMENTS OF THE INVENTION 

The present invention is a new and unique concept in the implementation of 
30 electronic signatures over the World Wide Web. It addresses such a need where 
users can sign legally enforceable documents and records on the Web using only 
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a Web browser. Therefore, the process of "signing" is preferably aligned with the 
purpose and structure of the service provider's Web site. No components are 
required to be installed or setup on the user's desktop and all user interactions and 
the required signatures occur within the Web browser. The term "document" is 
used herein in a very broad sense and can be a traditional electronic document 
(e.g. Microsoft Word or Excel, Adobe PDF, etc.) an HTML or XML page or form, a 
template and associated data elements, a scanned image of a paper document, 
etc. The document to be signed may be viewed in a browser, but is likely to begin 
and/or end in a traditional format such as MS Word or Adobe Acrobat, as well as 
Web-based formats such as HTML and XML. User identification is assumed to 
come from the service provider's Web site or through an ancillary Web service 
used by the service provider. This ensures that the service provider or operator of 
the Web site has properly identified the user to its satisfaction and access to the 
Web site is then considered secure. 

Referring to FIG. 1, there is shown a system 10 for applying a legally 
enforceable signature of a user on an electronic document in a web environment, 
according to a first preferred embodiment of the present invention. This system 10 
preferably consists of a set of modules that can be used in various combinations 
depending on the application that is running on the eCommerce Server of the 
service provider's Web site. One of the key advantages of the present system is 
that it is entirely server-based and it requires only a Web browser to be used on 
the end-user's desktop. 

The system 10 first includes accessing means for accessing the web 
environment from a secure electronic system, such as a link 12 to this web 
environment. For example, the user may simply log onto a Web site where she is a 
member and stores information that is unique about her within the context of that 
Web site (e.g. an account number). This web site therefore defines the secure 
electronic system. Once within the Web site, the user needs to sign a document, 
and simply click on a link that leads to the web environment of the invention. This 
web environment could physically be a part of the secure electronic system, or 
remotely connected thereto by a secure connection. In another preferred 
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embodiment, the user's Internet service provider itself could define the secure 
electronic system, it is therefore assumed that the eCommerce Server at the 
service provider's Web site where the electronic signing takes place has already 
identified the signer to its satisfaction. This may be accomplished by a variety of 
5 methods including the fact that the signer has been carrying out other transactions 
from this Web site and is verified by the service provider to in fact be that person. 

A document-rendering module 14 for presenting the user with a web-based 
representation of said document is also provided. This module allows the Web site 
to automatically prepare a document to present to the user through the Web 

10 browser. The Web site may need to retrieve the prepared document from a 
document storing location through appropriate retrieving means, or it creates the 
document on the fly using templates. A Document Customization Module 16, 
cooperating with the document-rendering module, is preferably provided for this 
purpose. Preferably, the Document rendering Module 14 prepares the document in 

1 5 HTML format or other format so that it may be presented to the user through his 
Web browser. Any appropriate means to transform the document from a non-web 
format to such a web format may therefore be provided as part of the document- 
rendering module. As a result, the user is able to easily review the document prior 
to signing it. The document-rendering module preferably provides a "Sign" button 

20 at the proper location in the document, so that clicking thereon may begin the 
signing process. 

The system 10 of the present invention also includes a legal disclosure 
module 20 for presenting the user, within the web environment, with legal 
information related to electronically signing of the document, and for obtaining 

25 agreement from the user of this legal information. Preferably, appropriate 
displaying means are used to display the legal information in a web-based 
medium, such as a series of Web pages or dialog boxes. The legal information 
aims to clearly notify the user of the signing that is about to take place and its 
purposes. The legal information preferably includes information about legal 

30 implications of using the ongoing process to electronically sign the document, or 
legal disclosures related to the document itself. The disclosure information also 
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preferably indicates what data or process is being used to create the electronic 
signature. These pages may also provide all legal disclosures and consent 
information that is required by the E-Sign or other legislation or regulation. The 
user is not allowed to proceed with the actual electronic signing of the document 
5 unless he has agreed to all the legal information, by clicking on "I Agree 1 ' buttons 
or equivalents. Each element of the legal information may be agreed to individually 
or as a group. Legal intent is therefore properly established and consented to 
through these disclosure pages. 

The system according to the present invention further includes a document 

10c approval module 22, for actually applying the signature of the user on the 
document upon agreement from the user of the legal disclosure and consent 
information. To perform the signing, a special signature file is preferably used. In 
the preferred embodiment, a special signature file is automatically created by a 
User Binding Module 24, using relevant data that is obtained from the secure 

1 5 electronic system. This data includes user-specific information uniquely identifying 
the user who is signing, and is preferably combined with the digital certificate and 
private key of the service provider's eCommerce Server that is controlling the 
signing process. This user-specific information in the signature file can also include 
a captured electronic image of the user's signature. Preferably, the document 

20 approval module embeds this signature file in the document, thereby effecting its 
signing. 

Also provided in the system 10 of the invention is a process log module 26 
for generating a process log of the signing, securely associated to the document 
as signed. In the preferred embodiment, the process log module 26 captures a 

25 record of every step of the signing process, and therefore further reduces the 
possibility of fraud. All the operation of the legal disclosure module and document 
approval module should in the minimum be included in this process, although 
during the course of the process leading up to and after the electronic signing, 
most if not all of the events in the process should preferably be recorded or 

30 observed such that at a later time they serve to support the act of signing. The 
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process log can then be used to reconstruct every Web page and step that 
occurred during the signing process, for future reference. 

By stating that the process log is "securely associated to the document", it is 
meant that measures are taken to ensure that the log is the true rendition of the 
5 signing of a particular document. In the preferred embodiment, a secure process 
authentication code uniquely representing the process log is embedded in the 
document as signed. For example, the secure process authentication code is 
embodied by a hash of the process log. Advantageously, this embodiment ensures 
that any tampering with the process log after the signing of the document would be 

1 0 immediately detectable when accessing this log by comparing a hash of the log 
accessed with the one provided in the signed document. The process log and 
secure process authentication code are also preferably stored in a database, on 
the present system or located elsewhere, for future reference. Similarly, to prevent 
tampering of the document after its signing, a secure document authentication 

15 code uniquely representing the document as signed, such as a hash of this 
document, is also embedded therein. This secure document authentication code is 
also stored on the system database to ensure that the process log also has the 
secure document authentication code. 

A Document Distribution Module 28 is finally provided for distributing the 

20 electronically signed document or record to the user, and any other party involved 
in the signing. This will enable each party to have an identical signed copy that can 
be used to avoid possible fraud in the future. This feature is advantageous in that 
when one signs a legally-enforceable document or record, this binding exists 
between two or more parties and each party should ideally receive a copy of the 

25 -signed document or record within a reasonable period after the completion of the 
signing process such that they remember or can verify that the contract (i.e. the 
electronically signed document or record) is what they have actually signed. This is 
effectively what happens today on paper. 

It is understood that the above description of the present system's 

30 constituent modules is provided at a high-level to assist in the understanding of the 
structure of this invention. Each of these modules actually consists of many sub- 
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components that are beyond the scope of this document due to their complexity. 
These sub-components include many optional capabilities such as a document 
store, a user password recovery mechanism, digital time stamping facility, and a 
digital notary. 

5 Referring to FIG. 3, there are shown a few additional modules that may for 

example be added to the system 10 of the present invention. "Document Modules" 
may include a document management module 18 in addition to the document 
customization module 16, the document-rendering module 14, the user binding 
module 24 and the document distribution module 28. The "Process Modules" 

10 include the above-described process log module 26, the document approval 
module 22, and additionally a hashing module 30, and a time stamping module 32. 
Tools such as a playback module 34, a system management console module 36 
or a software application to verify the document 38 may also be included. Other 
optional modules not shown in FIG. 3 include the following: identity management 

1 5 module, reporting module, billing module, archival module, template creation & 
validation module, policy manager module, and upload module. 

In accordance with another aspect of the present invention, there is also 
provided a web-based method for applying a legally enforceable signature of a 
user on an electronic document, the signing of this document occurring in a web 

20 environment. The method includes the following steps: 

a) having the user access the web environment from a secure electronic system, 
this secure system having verified the identity of the user; 

b) having the user sign the electronic document in the web environment. The 
signing includes the following substeps: 

25 i) presenting the user with a web-based representation of the document. 

The document may be retrieved from a document storing location or 
generated from a template. If the document is originally in a non-web 
format, it is preferably transformed into a web-compatible format; 
ii) presenting the user with legal information related to the signing operation, 

30 preferably through a series of web pages or dialog boxes. The user must 
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agree to this legal disclosure and consent information to move on to the 
next step; 

iii) upon agreement from the user of the legal information, applying the 
signature of the user on said document. Preferably, user-specific 
5 information is obtained from the secure electronic system and included in a 

special signature file, defining the electronic signature of the user that may 
include a captured electronic image of the signer's signature. The user 
specific information preferably includes a digital certificate and private key of 
the electronic system on which the signing process is being executed which 
1 0 are also associated to the document; and 

c) generating a process log of the signing operation, and securely associating this 
process log with the document. Ideally, this process log allows the reconstruction 
of at least substeps b) i) to b) iii) above as executed by the user. In the preferred 
embodiment, a secure process authentication code such as a hash of the process 

15 log is generated and embedded in the document as signed. Both the secure 
process authentication code and process log itself are also preferably stored in a 
log database for future reference. 

d) making the document as signed available to the user and any other parties 
concerned by said document. It may for example be e-mailed or otherwise 

20 transmitted to him, or sent to a download page accessible by all involved. 

Preferably, an additional step of providing an audit trail of the signing 
process inside the document is performed. Another possible additional step 
includes providing a secure document authentication code in the document, such 
as a hash thereof after signing. The secure document authentication code is also 

25 preferably stored in a database such as the log database. 

It is understood that the particular order in which the steps and substeps of 
the method above are performed is not material to the invention. ' For example, the 
legal disclosure and consent information may* be presented to the user before the 
electronic document itself. Any number of other immaterial modifications to the 

30 sequential order of the present method may equally be made. 
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Referring to FIGs. 2A to 2D, there is illustrated a more detailed embodiment 
of the method of the present invention identifying the different components of a 
system that may be used to perform this method. 

Referring to FIG. 2A, there is first illustrated the log in process of the user 
5 accessing the system. A log-in module is provided, ensuring a successful login of 
the user. The identity of the user is then checked through a user authentication 
module. User specific information is available for this purpose. The document is 
then prepared using templates, boilerplate text or user-specific information 
obtained from the system to which the user is logged on. 

10 Referring to FIG. 2B, there is shown how the document, once ready, is 

preferably stored in short-term document storage for future reference. A copy of 
the document is rendered to HTML or any other method used by the Web browser 
to which a "sign" button is added at an appropriate location. In this embodiment, 
the user first clicks on the sign button and is then taken to the legal disclosure and 

1 5 consent page or pages where the legal intent of the user is confirmed. The user 
may at this point go back to the Web browser rendition of the document to review 
its content again, if so desired. Once the user has agreed to all legal implications 
of the signing process, the actual approved document is created. The document is 
fetched from short-term storage, the unique information about the user 

20 representing his signature is attached thereto, and the document is preferably 
hashed, timestamped and signed using the system's private key. 

Referring to FIG. 2C, there is shown that the signed document is stored in 
long-term storage for future reference using the user's transaction id as unique 
key. From there, several options are possible. The document may be e-mailed to 

25 the user and any other interested party. It may be available for download and the 
user is automatically taken to the download page. Alternatively, an URL to the 
download page may be e-mailed to the user. 

FIG. 2D illustrates the download process. 

At each step of the method above, an archiving module keeps a record of 
30 the entire process. Preferably, this information is hashed and stored in a WORM 
log store. A digital notary provides a time stamp for each event. 
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It is understood that the embodiment of FIGs. 2A to 2D is given as an 
example and is in no way limitative to the scope of the present invention. 

Referring to FIG. 4, there is generally illustrated how the method and 
system of the present invention would for example appear to a user thereof. Other 
5 representations are possible. 

The Web-Based e-Signing Process is used here in the context of a 
merchant's e-Commerce Web site where an electronic approval and signature is 
required to complete a specific commercial transaction on the Web. Once a 
customer has completed the execution of a particular e-Commerce transaction or 
10 process and is ready to electronically sign a legally enforceable contract, the 
merchant's e-Commerce Web site performs a hand-off to the e-Signing Process 
and provides all pertinent data and information needed to generate the appropriate 
contract for approval and signature. Once this hand-off is complete, the customer 
is guided through three major steps that represent the core e-Signing Process. 

15 

1. Process. E-SIGN Law, and Legal Disclosures 

The e-Signing process starts by clearly explaining the electronic signing 
process that the customer is about to execute, providing a brief overview of the E- 
SIGN law, and displaying the legal disclosures and consent information required 
20 for that particular transaction or contract(s). The presentation method depicted in 
FIG. 4 is based on the use of tabs where each tab represents one of the following 
elements; 

® The Process tab explains the e-Signing process. 

9 The E-SIGN Law tab provides a brief overview of the E-SIGN law with 
25 hyperlinks to other relevant information. This tab also has "I CONSENT" and "I 
DO NOT CONSENT" buttons to capture the customer's consent as required by 
the E-SIGN law. 

o The Legal Disclosures tab presents all the required legal disclosures and 
consent information (LD1, LD2, etc.). An unlimited number of disclosures can 
30 be accommodated. 
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AH tabs have a check mark to indicate to the customer which legal 
disclosures and consent information have already been viewed or agreed to. 

It should be noted that the choice of tabs in this figure represents one 
implementation method that is used here to illustrate the invention. Other methods 
5 are also possible and will not impact the scope, applicability, or innovative nature 
of this invention. 

2. Contract Review and Approval 

After reviewing all the information provided in step 1, the customer proceeds 
10 to the next step where the contracts are reviewed and approved. An unlimited 
number of contracts can be presented (C1, C2, C3, C4, etc.). After reviewing each 
contract, the customer can either agree or disagree to the terms and conditions of 
a particular contract. As before, all tabs have a check mark to indicate to the 
customer which legal disclosures and consent information have already been 
1 5 agreed or disagreed to. 

3. Legal Implications and Contract Signing 

The last key step of the e-Signing process presents to the customer the 
legal implications of proceeding with the electronically signing of these contracts. 

20 This step also presents all customer information necessary to explain the legal 
implications in the context of the executed transaction. It is this information that will 
be used to electronically sign the contracts and bind the customer to these 
contracts based on a secure, tamper-proof, and non-refutable method as 
described above. Once the customer has signed the contracts, control returns to 

25 the merchant's e-Commerce Web site based on a pre-defined hand-back protocol, 
which transfers status data indicating which contracts were successfully signed 
and which were not. 

In parallel with the hand-back transfer of control to the merchant's e- 
Commerce Web site, the e-Signing Process provides the following: 
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o Thanks customers for using the e-Signing process and informs them that an e- 
mail will be sent to them, enabling them to download a copy of the signed 
contracts for their records; 

o Sends an e-mail to the customer with a link to the Download Page. The 
5 Download Page enables customers to download a copy of the signed contracts 
to be stored on their computers or printed. This page also provides customers 
with the ability to download a software application for verifying the authenticity 
of the signed contracts. Customers will also be provided with information on the 
technology requirements, both software and hardware, needed to view and 
1 0 print the downloaded contracts. 

o Upon viewing the technology requirements, customers will still have the option 
to request paper copies of the contracts should they decide to do so instead of 
proceeding with electronic contracts. 

The uses and advantages of the present invention are not limited to the 
1 5 embodiments described above. As further examples, the three following scenarios 
are considered for using the invention: 



1 . Signing of a document by a new member enrolling to the eCommerce Server of 
the service providers Web site 

20 In this case, the user is new to the service provider's Web site and will need to 
sign a document as part of the enrolment to the site or to obtain a service from the 
site. For example, an online mortgage company receives an application from a 
new customer. The new customer needs to provide information that will be used to 
identify himself. The new customer must then go through some kind of online 

25 identification process so that the online mortgage company can be certain that it 
will not be defrauded. If the service is successful, then the new customer proceeds 
with the signing process using the eSigning Server. It is possible that the service 
provider chooses to post-identify the new customer. That is, the identity of the new 
customer is assumed until some later event takes place such as submitting a 

30 check for payment that will serve to identify this customer. This approach is not 
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likely to work for all processes since it may not be possible to wait for such an 
event. 

2. Signing of a document bv an existing member of the eCommerce Server of the 
service provider's Web site 

Using the online brokerage Web site example, an existing member of the site 
needs to sign some authorization documents. Since the trader is a known member 
of the Web site, available identification information can be used for the purpose of 
signing. The trader's ability to log in gives them the right to sign. Signing can then 
proceed as described above with the full knowledge that the user has already 
been securely and positively identified. 



3. Signing of a do cument on a related Web site bv an existing member of the 
eCommerce Server of the service provider's Web site 

In this case, an existing member of a Web site must sign documents at a 
related, linked Web site. For example, an online banking site offers insurance to its 
existing members through a link from its eCommerce Server. When the member is 
linked to the insurance company's Web site, this member is "introduced" to the 
insurance Web site by the online banking Web site. The insurance Web site may 
then accept the identity of the online banking member without further verification 
and the member is now able to sign documents on its Web site using the process 
described above. In this case, this invention provides a capability through the 
eSigning Server to securely transfer the identity of the existing member to the 
related Web site. It is also possible for the eSigning Server of the online banking 
Web site to allow its members to sign an insurance company's documents on its 
Web site without the need to transfer the member and associated identity to the 
insurance company's Web site. 

Business applications for this present invention are numerous in the 
financial services area as well as other service providers or businesses requiring 
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the legal signing of contractual documents controlled through their Web sites. In 
the financial services area, applications include insurance applications, insurance 
claims, securities transaction authorizations^ mortgages, loans, leases, banking 
authorizations, and many other types of documents that require legally enforceable 
5 signatures. Outside of financial services, applications include general business 
contracts, non-disclosure agreements, proposals, bids, and response to RFPs. An 
example of a typical application would be an online brokerage Web site where 
members are required to sign authorization documents to allow for the transfer of 
funds or for opening new mutual fund accounts. In order to maintain control over 

10 these Web-based documents, they would generally be maintained at the Web site 
of the brokerage firm. Since these documents need to be signed, the service 
provider or Web site operator cannot burden the users by requiring the creation of 
special signatures or the installation of special software on their desktops in order 
to identify themselves for the purpose of electronically signing such documents. 

1 5 In addition to the applicability of this invention to the signing of Web-based, 

legally-enforceable documents in various industries (e.g. financial, pharmaceutical, 
government, legal, engineering, manufacturing, etc.), other possible uses for this 
invention include Web-based marketing, content source insurance, self-branding, 
cross-branding, syndication, digital rights protection, personalization, collaboration, 

20 gaming, and a wide range of emerging distributed or peer-to-peer applications, to 
name a few. 

In summary, this invention replaces a regular "I Agree" button or a 
typed name in Web pages by a process containing one or more "I Agree" buttons 
where that process sufficiently demonstrates the signers intent during the 

25 electronic signing process. Of course, the expression "I Agree" is given here by 
way of example as any other appropriate formulation could laternatively be used. 
The invention is also compatible with the capture of the signer's signature as an 
electronic image to be applied to the signed document. Furthermore, this invention 
* also provides for the collection and securing of digital data as electronic evidence 

30 such that the secure signing process and the securely signed document may be 
considered legally enforceable or legally binding. 
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Of course, numerous changes 
embodiments described above without 
as defined in the appended claims. 
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and modifications may be made to the 
departing from the scope of the invention 
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WHAT IS CLAIMED IS: 

1. A web-based method for applying a legally enforceable signature of a user on 
an electronic document, the signing of said document occurring in a web 

5 environment, said method comprising the steps of: 

a) having the user access the web environment from a secure electronic system, 
said secure system having verified the identity of the user; 

b) having the user sign the electronic document in said web environment, said 
signing comprising the substeps of: 

1 o i) presenting the user with a web-based representation of the document; 

ii) presenting the user with legal information related to said signing, and 
getting agreement from the user of said legal information; and 

iii) upon agreement from the user of the legal information, applying said 
signature of the user on said document; 

1 5 c) generating a process log of the signing of step b) and securely associating said 
process log with the document as signed; and 
d) making the document as signed available to the user. 

2. A method according to claim 1, wherein substep b) i) comprises retrieving said 
20 document from a document storing location. 

3. A method according to claim 1, wherein substep b) i) comprises generating said 
document from a template. 

25 4. A method according to claim 1, wherein substep b) i) comprises transforming 
said document from a non-web format to a web-format. 
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5. A method according to claim 1, wherein, in step b) ii), said legal information 
comprises information about legal implications of the signing of the document. 

30 
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6. A method according to claim 1, wherein, in step b) ii), said legal information 
comprises legal disclosures related to said document. 

7. A method according to claim 1, wherein substep b) ii) comprises presenting said 
5 legal information in a series of web pages. 

8. A method according to claim 1, wherein substep b) ii) comprises presenting said 
legal information in a series of dialog boxes. 

10 9. A method according to claim 1, wherein substep b) iii) comprises associating 
user-specific information to said document. 

10. A method according to claim 9, wherein, in substep b) iii), said user-specific 
information is included in a special signature file defining the signature of the user. 

15 

11. A method according to claim 9, wherein substep b) iii) further comprises 
associating a digital certificate and private key to the document. 

12. A method according to claim 9, wherein substep b) iii) further comprises 
20 obtaining said user-specific information from the secure electronic system. 

13. A method according to claims, wherein, in step c), said process log allows the 
reconstruction of substeps b) i) to b) iii) as executed by said user. 

25 14. A method according to claim 1, wherein step c) further comprises storing said 
process log in a log database. 



30 



15. A method according to claim 1, wherein step c) comprises the substeps of: 
i) generating a secure process authentication code uniquely representing said 
process log; and 
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ii) embedding said process authentication code in said document as signed, 
thereby securely associating said process log and document. 

16. A method according to claim 15, wherein, in step c) ii), said secure process 
5 authentication code is a hash of said process log. 

17. A method according to claim 1, comprising an additional step before step d) of 
providing an audit trail of the signing of step b) in the document as signed. 

10 18. A method according to claim 17, wherein said additional step comprises 
including a secure document authentication code uniquely representing said 
document as signed in said audit trail. 

19. A method according to claim 18, wherein said additional step further comprises 
1 5 storing said secure document authentication code in a database. 

20. A method according to claim 18, wherein said additional step further comprises 
generating a hash of said document as signed defining the secure document 
authentication code. 

20 

21. A method according to claim 1, comprising an additional step before step d) of 
embedding a secure document authentication code uniquely representing the 
document as signed inside said document. 

25 22. A method according to claim 1, wherein step d) comprises transmitting a copy 
of the document as signed to the user. 

23. A method according to claim 1, wherein step d) comprises enabling the user to 
download the document as signed. 

30 
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24. A method according to claim 1, wherein step d) further comprises making the 
document as signed available to at least one additional party concerned by said 
electronic document. 

25. A web-based method for applying a legally enforceable signature of a user on 
an electronic document, the signing of said document occurring in a web 
environment, said method comprising the steps of: 

a) having the user access the web environment from a secure electronic system, 
said secure system having verified an identity of the user; 

b) having the user sign the electronic document in said web environment, said 
signing comprising the substeps of: 

i) presenting the user with legal information related to said signing, and 
getting agreement from the user of said legal information; 

ii) presenting the user with a web-based representation of the document; 

iii) getting confirmation from the user that the document is to be signed; and 

iv) applying said signature of the user on said document; 

c) generating a process log of the signing of . step b) and securely associating said 
process log with the document as signed; and 

d) making the document as signed available to the user. 

26. A method according to claim 25, wherein, in step b) i), said legal information 
comprises information about legal implications of the signing of the document. 

27. A method according to claim 25, wherein, in step b) i), said legal information 
comprises legal disclosures related to said document. 

28. A method according to claim 25, wherein substep b) i) comprises presenting 
said legal information in a series of web pages. 

29. A method according to claim 25, wherein substep b) i) comprises presenting 
said legal information in a series of dialog boxes. 
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30. A method according to claim 25, wherein substep b) ii) comprises retrieving 
said document from a document storing location. 

5 31. A method according to claim 25, wherein substep b) ii) comprises generating 
said document from a template. 

32. A method according to claim 25, wherein substep b) ii) comprises transforming 
said document from a non-web format to a web-format. 

10 

33. A method according to claim 25, wherein substep b) iv) comprises associating 
user-specific information to said document. 

34. A method according to claim 33, wherein, in substep b) iv), said user-specific 
1 5 information is included in a special signature file defining the signature of the user. 

35. A method according to claim 33, wherein substep b) iv) further comprises 
associating a digital certificate and private key to the document. 

20 36. A method according to claim 33, wherein substep b) iv) further comprises 
obtaining said user-specific information from the secure electronic system. 

37. A method according to claim 25, wherein, in step c), said process log allows 
the reconstruction of substeps b) i) to b) iv) as executed by said user. 

25 

38. A method according to claim 25, wherein step c) further comprises storing said 
process log in a log database. 



30 



39. A method according to claim 25, wherein step c) comprises the substeps of: 
i) generating a secure process authentication code uniquely representing said ( 
process log; and 
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ii) embedding said process authentication code in said document as signed, 
thereby securely associating said process log and document. 

40. A method according to claim 39, wherein, in step c) ii), said secure process 
5 authentication code is hash of said process log. 

41. A method according to claim 25, comprising an additional step before step d) 
of providing an audit trail of the signing of step b) in the document as signed. 

10 42. A method according to claim 41, wherein said additional step comprises 
including a secure document authentication code uniquely representing said 
document as signed in said audit trail. 
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43. A method according to claim 42, wherein said additional step further comprises 
1 5 storing said secure document authentication code in a database. 

44. A method according to claim 42, wherein said additional step further comprises 
generating a hash of said document as signed defining the secure document 
authentication code. 

20 

45. A method according to claim 25, comprising an additional step before step d) 
of embedding a secure document authentication code uniquely representing the 
document as signed inside said document. 

25 46. A method according to claim 25, wherein step d) comprises transmitting a 
copy of the document as signed to the user. 

47. A method according to claim 25, wherein step d) comprises enabling the user 
to download the document as signed. 

30 



WO 02/48843 




PCT/CA01/01811 



24 

48. A method according to claim 25, wherein step d) further comprises sending a 
copy of the document as signed to at least one additional party concerned by said 
electronic document. 

5 49. A system for applying a legally-enforceable signature of a user on an electronic 
document in a web environment, said system comprising: 

accessing means for accessing said web . environment from a secure 
electronic system; 

a documeht-rendering module for presenting the user with a web-based 
1 0 representation of said document; 

a legal disclosure module for presenting the user, in said web environment, 
with legal information related to electronically signing said document, and for 
obtaining agreement from the user of said legal information; 

a document approval module for providing the signature of the user to the 
1 5 document upon agreement from the user of the legal information, thereby signing 
said document; 

a process log module for generating a process log of the signing of the 
document and securely associating said process log with the document as signed; 
and 

20 a document distribution module for making the document as signed 

available to the user. 

50. A system according to claim 49, wherein said document-rendering module 
comprises retrieving means for retrieving said document from a document storing 

25 location. 

51. A system according to claim 49, further comprising a document customization 
module cooperating with the document-rendering module for generating said 
document from a template. 

30 
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52. A system according to claim 49, wherein said document-rendering module 
comprises transforming means for transforming said document from a non-web 
format to a web-format. 

5 53. A system according to claim 49, wherein said legal information comprises 
information about legal implications of the signing of the document. 

54. A system according to claim 49, wherein said legal information comprises legal 
disclosures related to said document. 

10 

55. A system according to claim 49, wherein said legal disclosure module 
comprises displaying means for displaying said legal information in a web-based 
medium. 

15 56. A system according to claim 55, wherein said web-based medium includes a 
plurality of web pages. 

57. A system according to claim 55, wherein said web-based medium includes a 
plurality of dialogue boxes. t 

20 

58. A system according to claim 49, further comprising a user binding module 
cooperating with the secure electronic system to obtain therefrom user-specific 
information, generating a special signature file using said user-specific information 
and providing said special signature file to the document approval module, said 

25 special signature file defining the signature of the user. 



59, A system according to claim 58, wherein 
comprises a digital certificate and private key. 



said user-specific information 
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60. A system according to claim 49, wherein said process log comprises 
reconstruction data for allowing the reconstruction of the signing of the document 
as executed by said user. 

5 61. A system according to claim 49, wherein said process log module comprises 
means for generating a secure process authentication code uniquely representing 
said process log, and embedding said secure process authentication code in said 
document as signed, thereby securely associating said process log and document 

10 62. A system according to claim 61, wherein said means to generate a secure 
process authentication code comprise a hash module. 

63. A system according to claim 49, further comprising an audit trail module for 
providing an audit trail of the signing of the document in said document as signed. 

15 

64. A system according to claim 63, wherein said audit trail includes a secure 
document authentication code uniquely representing said document as signed. 

65. A system according to claim 64, wherein the document authentication code is 
20 a hash of said document as signed. 

66. A system according to claim 49, wherein the document approval module 
comprises means for embedding a document authentication code uniquely 
representing the document as signed inside said document. 

25 

67. A system according to claim 49, wherein said document distribution module 
comprises means for transmitting a copy of the document as signed to the user. 



30 



68. A system according to claim 69, wherein said document distribution module 
provides a copy of the document as signed to at least one additional party 
concerned by said electronic document. 
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